Auth: obtain access token from  app credentials

I don't think we can get away without `should(err).be.ok`. What if `err` is `null` or `undefined`?